Tools for developers who want to understand what they're doing.
Solve technical problems with zero server telemetry. Master underlying RFC specifications, protocol mechanics, and systems architecture.
What is Curious-Techie?
Curious-Techie is an independent, privacy-first technical knowledge platform engineered for software engineers, security researchers, and web developers. It provides browser-native utilities paired with in-depth architectural guides, RFC protocol specifications, interactive diagnostic labs, and engineering interview preparation. Every tool executes 100% locally in browser memory with zero server telemetry, no user tracking, and absolute data privacy.
Popular Technical Topics
Topical authority hubs exploring web protocols, browser security boundaries, cryptographic primitives, and data formats.
Cryptography & Hashing
One-way mathematical functions, digests, HMAC & collision resistance.
DNS & Internet Protocols
Hierarchical name resolution, DNS-over-HTTPS & domain registries.
Browser & Web Security
Cross-Origin Resource Sharing, CSP Level 3 & HTTP defensive headers.
Data Encodings & Formats
Binary-to-text schemes, percent-encoding & serialization mechanics.
Tokens & Stateless Auth
JSON Web Token anatomy, asymmetric signatures & claim verification.
Unique Identifiers & Epochs
128-bit distributed keys, time-ordered UUID v7 & Unix timestamps.
Client-Side Developer Utilities
Interactive utilities running 100% in local browser memory with zero network latency and complete privacy.
Featured Architectural Guides
In-depth explorations of web standards, RFC specifications, and system architecture fundamentals.
What is DNS & How Do Name Servers Work?
Understand the Domain Name System: hierarchical resolution trees, root servers, A/AAAA/MX/TXT records, and encrypted DNS-over-HTTPS (DoH).
Complete Guide to HTTP (Hypertext Transfer Protocol)
The Definitive Architectural Reference to HTTP/1.1, HTTP/2, HTTP/3, Request-Response Semantics, and Status Codes.
Complete Guide to HTTPS (HTTP Secure)
The Definitive Guide to Transport Layer Security over HTTP, Certificates, Mixed Content, and HSTS Enforcement.
What is SSL/TLS & How Do HTTPS Certificates Work?
Understand Transport Layer Security (TLS 1.3), asymmetric public key handshakes, X.509 certificate chains, and Certificate Transparency logs.
Complete Guide to Web Security
The Comprehensive Defense-in-Depth Blueprint: Browser Security Boundaries, Defensive Headers, and Modern Threat Mitigation.
What is JWT? JSON Web Token Architecture (RFC 7519)
Stateless authentication, header/payload/signature structure, Base64URL, algorithm confusion attacks, and why decoding is not verifying.
Problem → Solution Troubleshooting
Production-verified diagnosis trees, root cause analyses, and step-by-step resolution guides for common developer errors.
CORS Error: No Access-Control-Allow-Origin Header
The browser’s Same-Origin Policy blocked client JavaScript from reading the API response because the target server failed to return the Access-Control-Allow-Origin HTTP response header matching the requesting origin.
How to Fix CORS Preflight Errors
A CORS preflight error occurs when your backend fails to return a successful HTTP status (200 OK or 204 No Content) on the automatic preflight HTTP OPTIONS request, or fails to include Access-Control-Allow-Methods and Access-Control-Allow-Headers.
Why CSP Blocks JavaScript
The browser blocked your JavaScript because your server’s Content-Security-Policy (CSP) header does not permit inline scripts or the external domain hosting the script in its script-src directive.
Why JWT Works in Postman but Not in Browser
The request succeeds in Postman because Postman does not enforce the browser Same-Origin Policy (SOP). In a web browser, adding an Authorization: Bearer header triggers an automatic CORS preflight (HTTP OPTIONS) probe. If the backend fails the preflight or omits authorization from Access-Control-Allow-Headers, the browser blocks the token before the server ever reads it.
Developer References & Specifications
Exhaustive technical cheat sheets, protocol headers, HTTP status codes, and security directive matrices.
HTTP Status Codes Reference
HTTP status codes are 3-digit integers returned by servers: 1xx (Informational), 2xx (Success), 3xx (Redirection), 4xx (Client Error), and 5xx (Server Error). The first digit defines the response class.
HTTP Methods Reference
HTTP defines 9 standard request methods (verbs). "Safe" methods (GET, HEAD, OPTIONS) do not modify server state. "Idempotent" methods (GET, PUT, DELETE, HEAD, OPTIONS) produce the same server state if repeated multiple times.
HTTP Headers Reference
HTTP headers are colon-separated name-value pairs that convey metadata about requests, responses, caching, encoding, and browser security policies. Header field names are case-insensitive.
HTTP Content Types Reference
Content-Type follows the format "type/subtype; parameter=value". The top-level type denotes the general media class (text, application, image, multipart), and the subtype indicates the exact data format.
Interactive Diagnostic Labs
Hands-on browser simulations to inspect state machines, explore hashing avalanches, and test regex backtracking live.
DNS Resolution & Zone Configuration Lab: Debugging TTL Caching, Record Delegation, and NXDOMAIN Outages
Diagnose and remediate a live multi-region DNS propagation outage caused by a misconfigured CNAME apex alias and excessive negative cache TTL on an authoritative nameserver.
HTTP Lifecycle & Status Code Engineering Lab: Request-Response Pipelines, Headers, and Caching Controls
Construct raw HTTP requests, analyze status code transitions (200 vs 304 vs 412), and eliminate redundant payload transfer using HTTP conditional validation headers.
HTTPS & TLS Handshake Deep-Dive Lab: Certificate Chains, Cipher Suites, and Mixed-Content Remediation
Diagnose an incomplete X.509 certificate trust chain causing ERR_CERT_AUTHORITY_INVALID on mobile devices, and remediate mixed-content active blocking on an upgraded HTTPS web application.
JSON Web Token (JWT) Cryptographic Engineering Lab: Claim Tampering, Signature Verification, and Algorithm Confusion
Construct and cryptographically verify a JSON Web Token, test how tampering with a single payload claim breaks the signature, and prevent the "alg: none" privilege escalation attack.
Direct Technical Q&A
Clear, authoritative answers to high-frequency engineering questions without fluff or marketing filler.
Q: Can a JWT Be Decrypted by Anyone?
Yes, standard JSON Web Tokens (JWS) are signed, not encrypted. The header and payload are merely Base64URL-encoded strings that anyone can decode and read in plaintext without knowing the secret key.
Q: Why Shouldn't You Store JWTs in LocalStorage?
You should not store authentication JWTs in localStorage because any Cross-Site Scripting (XSS) vulnerability on your page allows malicious JavaScript to instantly read and exfiltrate the token. Storing tokens in HttpOnly, Secure, SameSite cookies protects them from JavaScript access.
Q: Can an Expired JWT Token Still Be Verified?
Yes, the cryptographic signature of an expired JWT remains mathematically valid because signatures are computed solely over the header and payload data. However, compliant JWT libraries will reject the token during authentication because the expiration claim (`exp`) is explicitly checked after signature verification.
Q: What Is the Difference Between Authentication and Authorization?
Authentication (AuthN) verifies who a user is (identity confirmation), while Authorization (AuthZ) determines what permissions or resources that authenticated user is allowed to access.
Engineering Interview Preparation
System design tradeoffs, architectural expectations, and model technical answers for senior engineering roles.
Walk me through the exact step-by-step process of what happens when you type a URL into a browser and resolve its DNS.
The browser checks 4 caching layers (browser cache, OS cache, router cache, ISP recursive resolver). If all miss, the recursive resolver traverses the hierarchy: Root Nameserver (.) -> TLD Nameserver (.com) -> Authoritative Nameserver (example.com), returning the A/AAAA record.
Why does the browser send an HTTP OPTIONS request before a POST request in CORS, and how do you prevent unnecessary preflight requests?
Browsers send preflight OPTIONS requests for "non-simple" requests (e.g. custom headers like Authorization or Content-Type: application/json) to verify the server safely understands the request before sending potentially state-changing data. Unnecessary preflights are cached using the Access-Control-Max-Age header.
Popular Across Curious-Techie
High-engagement guides, comparison matrices, and utilities most frequently referenced by software engineers.
SHA-256 vs SHA-512: Architectural Differences & Performance Benchmark
SHA-512 is fundamentally more secure and surprisingly runs faster on modern 64-bit CPUs than SHA-256 due to native 64-bit word operations. Choose SHA-256 for compact output and microcontrollers; choose SHA-512 for high-security applications and 64-bit server pipelines.
JWT vs Session Cookies: Stateless vs Stateful Web Authentication
Use Server Session Cookies for standard monolithic web applications and Single Page Applications sharing a backend domain. Use JWTs for distributed microservices, multi-region API gateways, and short-lived mobile authorization handshakes where database lookups on every request are prohibitive.
Base64 vs Hex
The fundamental difference between Base64 and Hex is storage efficiency versus human readability: Base64 encodes 6 bits per character using a 64-character alphabet, expanding binary data by only 33%. Hex (Base16) encodes 4 bits (a nibble) per character using a 16-character alphabet (0–9, a–f), expanding binary data by 100% (doubling its size).
DNS-over-HTTPS (DoH) vs DNS-over-TLS (DoT): Security & Censorship Comparison
DoH is superior for user privacy and censorship circumvention because its traffic blends inseparably with standard HTTPS web browsing on port 443. DoT is superior for enterprise network administration because dedicated port 853 allows network security teams to inspect or filter queries.
Recently Updated & Verified Content
Continuously audited technical content tracking the latest RFC standards, browser compatibility, and deprecations.
RFC 9110 HTTP Semantics & Method Idempotency Audit
Verified Active Standard • IETF HTTP Working Group
W3C Web Cryptography SubtleCrypto Memory Isolation Audit
100% Client-Side V8 Sandbox • W3C Web Security WG
RFC 9562 UUID Version 7 Timestamp-Ordered Entropy Review
Verified Sub-Millisecond Precision • IETF Standards Track
W3C Content Security Policy Level 3 Directive Compliance
Strict Nonce & Hash Verified • W3C Web Application Security
Explicit Knowledge Graph & Conceptual Relationships
How tools, standards, diagnostic labs, and security mechanisms interconnect across the Curious-Techie ecosystem.
Deconstructs cryptographic claims and Base64URL segments 100% locally in browser memory.
Translates 8-bit octets into 6-bit radix-64 printable characters with zero server telemetry.
Enforces strict cryptographic script nonces and restricts remote script execution domains.
Governs cross-origin HTTP fetch preflights under browser security boundaries.
Encapsulates UDP port 53 DNS queries inside encrypted HTTPS port 443 channels.
Visualizes NFA exponential state branch explosions live without crashing the main thread.